@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/flows-actors/mcp-servers.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-servers.shared.schemas.js","sourceRoot":"","sources":["../../../src/flows-actors/mcp-servers.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iEAAiE;AACjE,2DAA2D;AAC3D,iEAAiE;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,sEAAsE;IACtE,uDAA2B,CAAA;IAC3B,gFAAgF;IAChF,uCAAW,CAAA;AACb,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAYX;AAZD,WAAY,gCAAgC;IAC1C;;;;;OAKG;IACH,qFAAiD,CAAA;IACjD,uGAAuG;IACvG,iEAA6B,CAAA;IAC7B,oGAAoG;IACpG,iDAAa,CAAA;AACf,CAAC,EAZW,gCAAgC,KAAhC,gCAAgC,QAY3C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,sBAAsB,CAAC;CACnH,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,2FAA2F;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD,sFAAsF;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC3C,mGAAmG;IACnG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,UAAU,EAAE,qCAAqC;IACjD,QAAQ,EAAE,mCAAmC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;CAC9F,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\n//===============================================================\n//  MCP SERVERS — what an agent's `mcpRefs` resolve AGAINST\n//===============================================================\n\n/**\n * An MCP server an application permits its agents to reach.\n *\n * ## Why this exists (#491)\n *\n * `capabilities.tools.mcpRefs` was declared on the agent model, populated by a shipped catalog, and\n * rendered on the agent card — while nothing resolved a ref into a callable tool. The refs in that\n * catalog (`filesystem-mcp`, `git-mcp`, `browser-mcp`, `mongodb-mcp`, …) named no server anywhere;\n * they were authored against a field nothing read, so an agent card told a person the agent had a\n * reach it did not have.\n *\n * A ref must map to a transport, an endpoint and a credential. `functionRefs` have\n * `getFunctionTool`; these had no equivalent, so there was nothing to resolve against. This is that\n * equivalent, and it is what makes an `mcpRef` checkable.\n *\n * ## Why the APPLICATION declares it\n *\n * Decided 2026-09-09. An MCP tool call leaves the application's trust boundary and reaches a server\n * whose authorization is its own, so which third parties an application's agents may reach is the\n * application's decision — the same shape in which it already declares providers and capabilities.\n * Rejected: sourcing servers from the vendor provider catalogue (it describes REST operations, not\n * MCP endpoints, and would couple this to the provider architecture), and a platform-curated set an\n * application opts into (it makes the framework the gatekeeper of every application's third-party\n * reach, and needs a curation process that does not exist).\n *\n * This does not contradict the standing position that MCP is not an application's integration\n * runtime: an application calls a third-party API DIRECTLY, with typed operations. MCP is for the\n * case where an LLM agent sits between the application and the external system, which is exactly\n * what an agent's tool call is.\n */\n\n/**\n * How the runtime reaches the server.\n *\n * A closed vocabulary rather than a free string: the transport decides the whole connection\n * lifecycle — how a session opens, whether the server can push, how a stream ends — so a value\n * nobody implemented must be unrepresentable rather than discovered at the first call.\n *\n * STDIO is deliberately ABSENT. It launches a local subprocess, which is the coding-agent lane's\n * shape and not an application's: a generated application runs in a container it does not control,\n * and \"the agent may spawn a process\" is a different security decision from \"the agent may call an\n * endpoint\". Adding it later is a decision, not an omission.\n */\nexport enum FlowsActors_McpTransport {\n  /** Streamable HTTP — the current MCP transport for remote servers. */\n  HTTP_STREAM = 'http_stream',\n  /** Server-sent events — the earlier remote transport, still widely deployed. */\n  SSE = 'sse',\n}\n\n/**\n * WHOSE credential the call carries.\n *\n * The distinction is not a preference. A tool call that reaches a third party on a user's behalf\n * should be attributable to that user AT THE FAR END — that is what makes it revocable there and\n * auditable by the party being called. An application-wide service identity loses that: every\n * user's call looks identical to the server, and one leaked credential exposes every tenant.\n */\nexport enum FlowsActors_McpCredentialSubject {\n  /**\n   * The acting user's own delegated credential, falling back to the organization's connection when\n   * the user has none. The default, and the reason a fallback exists at all: an agent acting for a\n   * user who has never connected the server would otherwise have no path, which would make every\n   * unattended and batch turn impossible.\n   */\n  USER_THEN_ORGANIZATION = 'user_then_organization',\n  /** The organization's connection only — for a server the tenant connects once on everyone's behalf. */\n  ORGANIZATION = 'organization',\n  /** The acting user's own credential only. No fallback: a user who has not connected cannot call. */\n  USER = 'user',\n}\n\n/**\n * Which stored credential authorizes the call.\n *\n * `providerRef` names a provider the application has already connected, so the credential comes from\n * `organizationProviderCredentials` / `userProviderCredentials` rather than from a store invented\n * for MCP. Those exist, carry per-tenant isolation by construction, and already have the connect and\n * consent flow in front of them — a second credential store for this one call shape would be a\n * second thing to rotate, audit and leak.\n */\nexport const FlowsActors_McpServerCredentialSchema = z.object({\n  providerRef: z.string().min(1),\n  /**\n   * The slug in the provider's `secretsContract` — the same identifier the env projection names, and\n   * the one both credential resolver ports require.\n   *\n   * DECLARED rather than derived, because it is not derivable: a provider's contract may carry\n   * several secrets, and which of them authorizes an MCP endpoint is a fact about that vendor's\n   * deployment rather than anything the framework can compute. Guessing a conventional name would\n   * resolve the wrong secret silently — the resolver would find a credential, spend it, and be\n   * refused by the far server for a reason no log here would explain.\n   */\n  secretSlug: z.string().min(1),\n  subject: z.enum(FlowsActors_McpCredentialSubject).default(FlowsActors_McpCredentialSubject.USER_THEN_ORGANIZATION),\n});\nexport type FlowsActors_McpServerCredential = z.infer<typeof FlowsActors_McpServerCredentialSchema>;\n\n/**\n * Bounds on a call that leaves the trust boundary.\n *\n * Present with defaults rather than optional-and-unbounded, because an MCP call is a REMOTE call and\n * the mistake this whole issue warns against is modelling it as a second kind of local function. A\n * local function cannot hang; this can, and an unbounded tool call holds a model turn open for as\n * long as somebody else's server feels like it.\n */\nexport const FlowsActors_McpServerTimeoutsSchema = z.object({\n  /** How long tool DISCOVERY may take before the server contributes no tools to the turn. */\n  discoveryMs: z.number().int().positive().default(5_000),\n  /** How long one tool CALL may take before it returns a typed timeout to the agent. */\n  callMs: z.number().int().positive().default(30_000),\n});\nexport type FlowsActors_McpServerTimeouts = z.infer<typeof FlowsActors_McpServerTimeoutsSchema>;\n\nexport const FlowsActors_McpServerSchema = z.object({\n  /** The value an agent's `capabilities.tools.mcpRefs` names. Unique within an application. */\n  ref: z.string().min(1),\n  displayName: z.string().min(1),\n  transport: z.enum(FlowsActors_McpTransport),\n  /** The server's endpoint. `https` in every deployed environment; the runtime refuses plaintext. */\n  url: z.string().url(),\n  credential: FlowsActors_McpServerCredentialSchema,\n  timeouts: FlowsActors_McpServerTimeoutsSchema.default({ discoveryMs: 5_000, callMs: 30_000 }),\n});\nexport type FlowsActors_McpServer = z.infer<typeof FlowsActors_McpServerSchema>;\n\n/**\n * Whether an MCP endpoint is reached over plaintext.\n *\n * Exported rather than inlined because two callers need the same answer — registration, which\n * refuses, and the audit trail, which records what was refused — and a second spelling of \"is this\n * http\" is how the two come to disagree. Mirrors the webhook lane's identical predicate.\n */\nexport function mcpServerTransportIsPlaintext(url: string): boolean {\n  try {\n    return new URL(url).protocol === 'http:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The server's host, for a log or an audit row that must NOT carry the full URL.\n *\n * An MCP endpoint routinely carries a tenant or session identifier in its path or query, so the host\n * is the part that can be recorded freely.\n */\nexport function mcpServerDestinationHost(url: string): string {\n  try {\n    return new URL(url).host;\n  } catch {\n    return 'unparseable';\n  }\n}\n"]}
+{"version":3,"file":"mcp-servers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/mcp-servers.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iEAAiE;AACjE,2DAA2D;AAC3D,iEAAiE;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,sEAAsE;IACtE,uDAA2B,CAAA;IAC3B,gFAAgF;IAChF,uCAAW,CAAA;AACb,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAYX;AAZD,WAAY,gCAAgC;IAC1C;;;;;OAKG;IACH,qFAAiD,CAAA;IACjD,uGAAuG;IACvG,iEAA6B,CAAA;IAC7B,oGAAoG;IACpG,iDAAa,CAAA;AACf,CAAC,EAZW,gCAAgC,KAAhC,gCAAgC,QAY3C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,sBAAsB,CAAC;CACnH,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,2FAA2F;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD,sFAAsF;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC3C,mGAAmG;IACnG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,UAAU,EAAE,qCAAqC;IACjD,QAAQ,EAAE,mCAAmC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;CAC9F,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\n//===============================================================\n//  MCP SERVERS — what an agent's `mcpRefs` resolve AGAINST\n//===============================================================\n\n/**\n * An MCP server an application permits its agents to reach.\n *\n * ## Why this exists (#491)\n *\n * `capabilities.tools.mcpRefs` was declared on the agent model, populated by a shipped catalog, and\n * rendered on the agent card — while nothing resolved a ref into a callable tool. The refs in that\n * catalog (`filesystem-mcp`, `git-mcp`, `browser-mcp`, `mongodb-mcp`, …) named no server anywhere;\n * they were authored against a field nothing read, so an agent card told a person the agent had a\n * reach it did not have.\n *\n * A ref must map to a transport, an endpoint and a credential. `functionRefs` have\n * `getFunctionTool`; these had no equivalent, so there was nothing to resolve against. This is that\n * equivalent, and it is what makes an `mcpRef` checkable.\n *\n * ## Why the APPLICATION declares it\n *\n * Decided 2026-09-09. An MCP tool call leaves the application's trust boundary and reaches a server\n * whose authorization is its own, so which third parties an application's agents may reach is the\n * application's decision — the same shape in which it already declares providers and capabilities.\n * Rejected: sourcing servers from the vendor provider catalogue (it describes REST operations, not\n * MCP endpoints, and would couple this to the provider architecture), and a platform-curated set an\n * application opts into (it makes the framework the gatekeeper of every application's third-party\n * reach, and needs a curation process that does not exist).\n *\n * This does not contradict the standing position that MCP is not an application's integration\n * runtime: an application calls a third-party API DIRECTLY, with typed operations. MCP is for the\n * case where an LLM agent sits between the application and the external system, which is exactly\n * what an agent's tool call is.\n */\n\n/**\n * How the runtime reaches the server.\n *\n * A closed vocabulary rather than a free string: the transport decides the whole connection\n * lifecycle — how a session opens, whether the server can push, how a stream ends — so a value\n * nobody implemented must be unrepresentable rather than discovered at the first call.\n *\n * STDIO is deliberately ABSENT. It launches a local subprocess, which is the coding-agent lane's\n * shape and not an application's: a generated application runs in a container it does not control,\n * and \"the agent may spawn a process\" is a different security decision from \"the agent may call an\n * endpoint\". Adding it later is a decision, not an omission.\n */\nexport enum FlowsActors_McpTransport {\n  /** Streamable HTTP — the current MCP transport for remote servers. */\n  HTTP_STREAM = 'http_stream',\n  /** Server-sent events — the earlier remote transport, still widely deployed. */\n  SSE = 'sse',\n}\n\n/**\n * WHOSE credential the call carries.\n *\n * The distinction is not a preference. A tool call that reaches a third party on a user's behalf\n * should be attributable to that user AT THE FAR END — that is what makes it revocable there and\n * auditable by the party being called. An application-wide service identity loses that: every\n * user's call looks identical to the server, and one leaked credential exposes every tenant.\n */\nexport enum FlowsActors_McpCredentialSubject {\n  /**\n   * The acting user's own delegated credential, falling back to the organization's connection when\n   * the user has none. The default, and the reason a fallback exists at all: an agent acting for a\n   * user who has never connected the server would otherwise have no path, which would make every\n   * unattended and batch turn impossible.\n   */\n  USER_THEN_ORGANIZATION = 'user_then_organization',\n  /** The organization's connection only — for a server the tenant connects once on everyone's behalf. */\n  ORGANIZATION = 'organization',\n  /** The acting user's own credential only. No fallback: a user who has not connected cannot call. */\n  USER = 'user',\n}\n\n/**\n * Which stored credential authorizes the call.\n *\n * `providerRef` names a provider the application has already connected, so the credential comes from\n * `organizationProviderCredentials` / `userProviderCredentials` rather than from a store invented\n * for MCP. Those exist, carry per-tenant isolation by construction, and already have the connect and\n * consent flow in front of them — a second credential store for this one call shape would be a\n * second thing to rotate, audit and leak.\n */\nexport const FlowsActors_McpServerCredentialSchema = z.object({\n  providerRef: z.string().min(1),\n  /**\n   * The provider's `secretsContract` KEY (`accessToken`) — the one both credential resolver ports\n   * require, and NOT the slot's env-var spelling (`VENDOR_ACCESS_TOKEN`) the env projection names.\n   * Stored credentials are keyed on the key (#624), and this value reaches the stores verbatim, so a\n   * spelling here misses a credential that exists.\n   *\n   * DECLARED rather than derived, because it is not derivable: a provider's contract may carry\n   * several secrets, and which of them authorizes an MCP endpoint is a fact about that vendor's\n   * deployment rather than anything the framework can compute. Guessing a conventional name would\n   * resolve the wrong secret silently — the resolver would find a credential, spend it, and be\n   * refused by the far server for a reason no log here would explain.\n   */\n  secretSlug: z.string().min(1),\n  subject: z.enum(FlowsActors_McpCredentialSubject).default(FlowsActors_McpCredentialSubject.USER_THEN_ORGANIZATION),\n});\nexport type FlowsActors_McpServerCredential = z.infer<typeof FlowsActors_McpServerCredentialSchema>;\n\n/**\n * Bounds on a call that leaves the trust boundary.\n *\n * Present with defaults rather than optional-and-unbounded, because an MCP call is a REMOTE call and\n * the mistake this whole issue warns against is modelling it as a second kind of local function. A\n * local function cannot hang; this can, and an unbounded tool call holds a model turn open for as\n * long as somebody else's server feels like it.\n */\nexport const FlowsActors_McpServerTimeoutsSchema = z.object({\n  /** How long tool DISCOVERY may take before the server contributes no tools to the turn. */\n  discoveryMs: z.number().int().positive().default(5_000),\n  /** How long one tool CALL may take before it returns a typed timeout to the agent. */\n  callMs: z.number().int().positive().default(30_000),\n});\nexport type FlowsActors_McpServerTimeouts = z.infer<typeof FlowsActors_McpServerTimeoutsSchema>;\n\nexport const FlowsActors_McpServerSchema = z.object({\n  /** The value an agent's `capabilities.tools.mcpRefs` names. Unique within an application. */\n  ref: z.string().min(1),\n  displayName: z.string().min(1),\n  transport: z.enum(FlowsActors_McpTransport),\n  /** The server's endpoint. `https` in every deployed environment; the runtime refuses plaintext. */\n  url: z.string().url(),\n  credential: FlowsActors_McpServerCredentialSchema,\n  timeouts: FlowsActors_McpServerTimeoutsSchema.default({ discoveryMs: 5_000, callMs: 30_000 }),\n});\nexport type FlowsActors_McpServer = z.infer<typeof FlowsActors_McpServerSchema>;\n\n/**\n * Whether an MCP endpoint is reached over plaintext.\n *\n * Exported rather than inlined because two callers need the same answer — registration, which\n * refuses, and the audit trail, which records what was refused — and a second spelling of \"is this\n * http\" is how the two come to disagree. Mirrors the webhook lane's identical predicate.\n */\nexport function mcpServerTransportIsPlaintext(url: string): boolean {\n  try {\n    return new URL(url).protocol === 'http:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The server's host, for a log or an audit row that must NOT carry the full URL.\n *\n * An MCP endpoint routinely carries a tenant or session identifier in its path or query, so the host\n * is the part that can be recorded freely.\n */\nexport function mcpServerDestinationHost(url: string): string {\n  try {\n    return new URL(url).host;\n  } catch {\n    return 'unparseable';\n  }\n}\n"]}

package/dist/esm/flows-actors/prompt-ir.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-ir.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/flows-actors/prompt-ir.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAmBhF,OAAO,EAAE,wBAAwB,IAAI,qBAAqB,EAAE,CAAC;AAO7D;;;GAGG;AACH,oBAAY,mBAAmB;IAC7B,IAAI,SAAS,CAAQ,0CAA0C;IAC/D,MAAM,WAAW,CAAI,qDAAqD;IAC1E,GAAG,QAAQ;CACZ;AAED;;GAEG;AACH,oBAAY,0BAA0B;IACpC,GAAG,QAAQ;IACX,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,UAAU,eAAe;CAC1B;AAOD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAqBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBAyBxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"prompt-ir.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/prompt-ir.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAmBhF,OAAO,EAAE,wBAAwB,IAAI,qBAAqB,EAAE,CAAC;AAO7D;;;GAGG;AACH,oBAAY,mBAAmB;IAC7B,IAAI,SAAS,CAAQ,0CAA0C;IAC/D,MAAM,WAAW,CAAI,qDAAqD;IAC1E,GAAG,QAAQ;CACZ;AAED;;GAEG;AACH,oBAAY,0BAA0B;IACpC,GAAG,QAAQ;IACX,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,UAAU,eAAe;CAC1B;AAOD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAqBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBAyBxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/esm/flows-actors/provider-call-records.shared.resources-config.schemas.d.ts

@@ -0,0 +1,24 @@
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../resources/resources.shared.schemas';
+export declare const providerCallRecordsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.DELETE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, import("zod").ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+    agentRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    kind: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("./agent-traceability.shared.schemas").AgentCallTraceKind>>;
+    provider: import("zod").ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>;
+    model: import("zod").ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>;
+    attempt: import("zod").ZodOptional<import("zod").ZodNumber>;
+    calledAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDate>>;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("./agent-traceability.shared.schemas").AgentCallOutcome>>>;
+    finishReason: import("zod").ZodOptional<import("zod").ZodString>;
+    durationMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+    promptTokens: import("zod").ZodOptional<import("zod").ZodNumber>;
+    completionTokens: import("zod").ZodOptional<import("zod").ZodNumber>;
+    totalTokens: import("zod").ZodOptional<import("zod").ZodNumber>;
+    usageComplete: import("zod").ZodOptional<import("zod").ZodBoolean>;
+    errorName: import("zod").ZodOptional<import("zod").ZodString>;
+    errorCode: import("zod").ZodOptional<import("zod").ZodString>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDate>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>>;
+}, import("zod/v4/core").$strip>>;
+//# sourceMappingURL=provider-call-records.shared.resources-config.schemas.d.ts.map

package/dist/esm/flows-actors/provider-call-records.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-call-records.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/provider-call-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,8DAA8D,GACzE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;iCA8D9C,CAAC"}

package/dist/esm/flows-actors/provider-call-records.shared.resources-config.schemas.js

@@ -0,0 +1,80 @@
+/**
+ * Provider-call records: resource configuration (engine-internal, no HTTP surface).
+ *
+ * Every variant is `REPOSITORY_ONLY`, the `JOB_EXECUTIONS` shape: the ONE writer is the engine's
+ * provider-call recorder, and the ONE reader is the provider-call evidence door, which aggregates the
+ * rows for a window rather than handing any of them over. No route is generated, so nothing here is
+ * reachable except through those two.
+ *
+ * The writer uses the repository directly rather than the trusted-system-write primitive on purpose:
+ * `createAsSystem` emits a `SYSTEM_CONTEXT_WRITE` audit row per call, which here would put one audit
+ * row beside every provider call. This row is itself the record; auditing its creation would double
+ * the volume and say nothing the row does not.
+ *
+ * APPEND-ONLY: there is no UPDATE. A call happened; a later call is a new row. `DELETE_MANY` exists
+ * only for the bounded retention sweep that enforces `expiresAt` on PostgreSQL.
+ */
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { ProviderCallRecordSchema } from './provider-call-records.shared.schemas.js';
+export const providerCallRecordsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ProviderCallRecordSchema,
+    resourceIdentifier: CoreResourceType.PROVIDER_CALL_RECORDS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PROVIDER_CALL_RECORDS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /*
+     * Subject-export: FORBIDDEN, and deliberately NO `retentionPolicy`. A provider-call record holds no
+     * content and names no person (see the schema header), so it is not data about a subject and no
+     * erasure visits it. FORBIDDEN rather than undeclared so the decision is visible, the
+     * `JOB_EXECUTIONS` precedent. If a field ever attributes a call to a person, this exemption is wrong
+     * and must be revisited in the same change.
+     */
+    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.DELETE_MANY,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        // The bounded retention sweep resolves this before deleting expired rows. Repository-only, so
+        // enforcing retention never creates a public deletion route.
+        [CoreResourceOperation.DELETE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+    },
+});
+//# sourceMappingURL=provider-call-records.shared.resources-config.schemas.js.map

package/dist/esm/flows-actors/provider-call-records.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-call-records.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/provider-call-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAElF,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAC5E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,qBAAqB;IAC1D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;IACnG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;OAMG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8FAA8F;QAC9F,6DAA6D;QAC7D,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Provider-call records: resource configuration (engine-internal, no HTTP surface).\n *\n * Every variant is `REPOSITORY_ONLY`, the `JOB_EXECUTIONS` shape: the ONE writer is the engine's\n * provider-call recorder, and the ONE reader is the provider-call evidence door, which aggregates the\n * rows for a window rather than handing any of them over. No route is generated, so nothing here is\n * reachable except through those two.\n *\n * The writer uses the repository directly rather than the trusted-system-write primitive on purpose:\n * `createAsSystem` emits a `SYSTEM_CONTEXT_WRITE` audit row per call, which here would put one audit\n * row beside every provider call. This row is itself the record; auditing its creation would double\n * the volume and say nothing the row does not.\n *\n * APPEND-ONLY: there is no UPDATE. A call happened; a later call is a new row. `DELETE_MANY` exists\n * only for the bounded retention sweep that enforces `expiresAt` on PostgreSQL.\n */\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ProviderCallRecordSchema } from './provider-call-records.shared.schemas';\n\nexport const providerCallRecordsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.DELETE_MANY,\n  typeof ProviderCallRecordSchema\n>({\n  mainSchema: ProviderCallRecordSchema,\n  resourceIdentifier: CoreResourceType.PROVIDER_CALL_RECORDS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PROVIDER_CALL_RECORDS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /*\n   * Subject-export: FORBIDDEN, and deliberately NO `retentionPolicy`. A provider-call record holds no\n   * content and names no person (see the schema header), so it is not data about a subject and no\n   * erasure visits it. FORBIDDEN rather than undeclared so the decision is visible, the\n   * `JOB_EXECUTIONS` precedent. If a field ever attributes a call to a person, this exemption is wrong\n   * and must be revisited in the same change.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.DELETE_MANY,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    // The bounded retention sweep resolves this before deleting expired rows. Repository-only, so\n    // enforcing retention never creates a public deletion route.\n    [CoreResourceOperation.DELETE_MANY]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.HIGH,\n      }],\n    },\n  },\n});\n"]}

package/dist/esm/flows-actors/provider-call-records.shared.schemas.d.ts

@@ -0,0 +1,123 @@
+/**
+ * One row per PHYSICAL call to a model provider: which provider, which model, what kind of call, how
+ * it ended and what it consumed. The queryable record that `evidence-requirement:outbound-call-record`
+ * C2 demands ("every physical provider call is recorded — provider, model, usage and outcome").
+ *
+ * ## Why a store, when every call already emits a trace
+ *
+ * The engine emits an {@link AgentCallTrace} per call, and until this existed every destination of it
+ * was TELEMETRY: the application log, an LLM-analytics vendor, an observability forwarder, the dev
+ * companion's files. None is a store the product owns, so none can be queried for a window, and each
+ * one's lifetime was set by log rotation or a vendor rather than by an evidence-retention decision.
+ * The trace is also emitted only when an observability provider is active: at the default traceability
+ * level `NONE` nothing is emitted at all. Evidence cannot depend on an observability setting, so this
+ * record is written by its own seam, on every call, whatever the traceability level.
+ *
+ * ## Metadata only, by construction
+ *
+ * The trace carries the prompt (`input`), the completion (`output`) and the error MESSAGE, and any of
+ * them can hold a person's content: a prompt is user text, and a provider error routinely echoes the
+ * request back. None of them is copied. {@link projectProviderCallRecord} is the only producer, and it
+ * reads a closed list of fields, so a field added to the trace later cannot reach this table by
+ * accident. What stays is what the clause asks for plus what makes a row interpretable (duration,
+ * finish reason, error class).
+ *
+ * Holding no content is also what makes this row NOT personal data: it describes a call the
+ * application made, with no subject in it. That is why no field carries `dataCategories`, and why it
+ * is not attributed to a user or a tenant. Per-tenant attribution would be useful for cost and is
+ * deliberately left out until something reads it: an organization id here would make every row a
+ * statement about a customer, with the retention and erasure obligations that follow.
+ *
+ * ## Retention
+ *
+ * Every row carries its own absolute expiry, {@link PROVIDER_CALL_RECORD_RETENTION_MS} after the call,
+ * enforced by the framework's `.ttl()` mechanism: a TTL index on MongoDB and the bounded
+ * `resource-retention-sweep` batch on PostgreSQL. Absolute rather than a window measured from a field,
+ * so a later per-application retention choice changes what is WRITTEN and never needs a schema change,
+ * the shape the scheduled-evidence records already use.
+ */
+import { z } from 'zod';
+import { AgentCallOutcome, AgentCallTraceKind, type AgentCallTrace } from './agent-traceability.shared.schemas';
+/**
+ * How long a provider-call record is kept: 400 days.
+ *
+ * The period this repository already keeps retained evidence for (scheduled-run evidence), chosen so
+ * that one year of calls is always citable with a margin for the review that reads it. It belongs to
+ * the `AUDIT_LOGS` retention class in spirit: the record an operator needs to show what the application
+ * sent to whom, kept longer than operational logs for that reason.
+ */
+export declare const PROVIDER_CALL_RECORD_RETENTION_MS: number;
+export declare const ProviderCallRecordSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    agentRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    kind: z.ZodDefault<z.ZodEnum<typeof AgentCallTraceKind>>;
+    provider: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    model: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    attempt: z.ZodOptional<z.ZodNumber>;
+    calledAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AgentCallOutcome>>>;
+    finishReason: z.ZodOptional<z.ZodString>;
+    durationMs: z.ZodOptional<z.ZodNumber>;
+    promptTokens: z.ZodOptional<z.ZodNumber>;
+    completionTokens: z.ZodOptional<z.ZodNumber>;
+    totalTokens: z.ZodOptional<z.ZodNumber>;
+    usageComplete: z.ZodOptional<z.ZodBoolean>;
+    errorName: z.ZodOptional<z.ZodString>;
+    errorCode: z.ZodOptional<z.ZodString>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+}, z.core.$strip>;
+export type ProviderCallRecord = z.infer<typeof ProviderCallRecordSchema>;
+/**
+ * The ONLY way a provider-call record is built: a closed projection of an {@link AgentCallTrace}.
+ *
+ * Closed on purpose. It names every field it copies, so the prompt, the completion and the error
+ * message cannot reach the table through a field someone adds to the trace later. `calledAt` falls
+ * back to `recordedAt` only when the trace's own timestamp does not parse, so a malformed timestamp
+ * costs precision rather than the record.
+ */
+export declare function projectProviderCallRecord(trace: AgentCallTrace, { applicationId, recordedAt }: {
+    applicationId: string;
+    recordedAt: Date;
+}): Omit<ProviderCallRecord, '_id' | 'createdAt'>;
+/**
+ * # Provider calls, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — what the application sent to which
+ * vendor is answerable for any window, without handing over a row.
+ *
+ * What `GET /assurance/provider-call-evidence` returns: COUNTS over a closed window, computed where the
+ * rows live. Counts rather than rows because the question ("was every call recorded with provider,
+ * model, usage and outcome?") is a statement about the population, and because a row names an agent
+ * and a timestamp that an evidence reader has no need to hold.
+ *
+ * The completeness counts are what make a gap visible: a call recorded with no provider, or a provider
+ * that reported no usage, is counted apart rather than folded into the total, so "every call was
+ * recorded" and "every recorded call is complete" are two separate answers.
+ */
+export declare const ProviderCallEvidenceSchema: z.ZodObject<{
+    window: z.ZodObject<{
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strip>;
+    totalCalls: z.ZodNumber;
+    failedCalls: z.ZodNumber;
+    callsWithoutProvider: z.ZodNumber;
+    callsWithoutModel: z.ZodNumber;
+    callsReportingTokens: z.ZodNumber;
+    callsWithCompleteUsage: z.ZodNumber;
+    declaredProviderRefs: z.ZodNullable<z.ZodArray<z.ZodString>>;
+    byProviderModel: z.ZodArray<z.ZodObject<{
+        provider: z.ZodNullable<z.ZodString>;
+        model: z.ZodNullable<z.ZodString>;
+        kind: z.ZodEnum<typeof AgentCallTraceKind>;
+        outcome: z.ZodEnum<typeof AgentCallOutcome>;
+        calls: z.ZodNumber;
+        promptTokens: z.ZodNumber;
+        completionTokens: z.ZodNumber;
+        totalTokens: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ProviderCallEvidence = z.infer<typeof ProviderCallEvidenceSchema>;
+//# sourceMappingURL=provider-call-records.shared.schemas.d.ts.map

package/dist/esm/flows-actors/provider-call-records.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-call-records.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/provider-call-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAEhH;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,QAA4B,CAAC;AAE3E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBAmDnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAO1E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,cAAc,EACrB,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GACzE,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,WAAW,CAAC,CAuB/C;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;iBAiCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/esm/flows-actors/provider-call-records.shared.schemas.js

@@ -0,0 +1,181 @@
+/**
+ * One row per PHYSICAL call to a model provider: which provider, which model, what kind of call, how
+ * it ended and what it consumed. The queryable record that `evidence-requirement:outbound-call-record`
+ * C2 demands ("every physical provider call is recorded — provider, model, usage and outcome").
+ *
+ * ## Why a store, when every call already emits a trace
+ *
+ * The engine emits an {@link AgentCallTrace} per call, and until this existed every destination of it
+ * was TELEMETRY: the application log, an LLM-analytics vendor, an observability forwarder, the dev
+ * companion's files. None is a store the product owns, so none can be queried for a window, and each
+ * one's lifetime was set by log rotation or a vendor rather than by an evidence-retention decision.
+ * The trace is also emitted only when an observability provider is active: at the default traceability
+ * level `NONE` nothing is emitted at all. Evidence cannot depend on an observability setting, so this
+ * record is written by its own seam, on every call, whatever the traceability level.
+ *
+ * ## Metadata only, by construction
+ *
+ * The trace carries the prompt (`input`), the completion (`output`) and the error MESSAGE, and any of
+ * them can hold a person's content: a prompt is user text, and a provider error routinely echoes the
+ * request back. None of them is copied. {@link projectProviderCallRecord} is the only producer, and it
+ * reads a closed list of fields, so a field added to the trace later cannot reach this table by
+ * accident. What stays is what the clause asks for plus what makes a row interpretable (duration,
+ * finish reason, error class).
+ *
+ * Holding no content is also what makes this row NOT personal data: it describes a call the
+ * application made, with no subject in it. That is why no field carries `dataCategories`, and why it
+ * is not attributed to a user or a tenant. Per-tenant attribution would be useful for cost and is
+ * deliberately left out until something reads it: an organization id here would make every row a
+ * statement about a customer, with the retention and erasure obligations that follow.
+ *
+ * ## Retention
+ *
+ * Every row carries its own absolute expiry, {@link PROVIDER_CALL_RECORD_RETENTION_MS} after the call,
+ * enforced by the framework's `.ttl()` mechanism: a TTL index on MongoDB and the bounded
+ * `resource-retention-sweep` batch on PostgreSQL. Absolute rather than a window measured from a field,
+ * so a later per-application retention choice changes what is WRITTEN and never needs a schema change,
+ * the shape the scheduled-evidence records already use.
+ */
+import { z } from 'zod';
+import { AgentCallOutcome, AgentCallTraceKind } from './agent-traceability.shared.schemas.js';
+/**
+ * How long a provider-call record is kept: 400 days.
+ *
+ * The period this repository already keeps retained evidence for (scheduled-run evidence), chosen so
+ * that one year of calls is always citable with a margin for the review that reads it. It belongs to
+ * the `AUDIT_LOGS` retention class in spirit: the record an operator needs to show what the application
+ * sent to whom, kept longer than operational logs for that reason.
+ */
+export const PROVIDER_CALL_RECORD_RETENTION_MS = 400 * 24 * 60 * 60 * 1000;
+export const ProviderCallRecordSchema = z.object({
+    /** Document id. `.isPrimaryKey()` is what makes the PostgreSQL planner emit the PRIMARY KEY constraint. */
+    _id: z.string().isPrimaryKey().isSummaryField(),
+    /**
+     * The application RECORD id, the APPLICATION scope's key. Stamped from the canonical identity by the
+     * recorder, never taken from the call, for the reason `JobExecution.applicationId` gives.
+     */
+    applicationId: z.string().isDBIndexed(),
+    /** The agent the call served (`agentRef`), or the service's own label for an embedding or extraction. */
+    agentRef: z.string().min(1).isDBIndexed().isSummaryField(),
+    /** GENERATION or EMBEDDING. The two consume tokens differently, so usage is only comparable within a kind. */
+    kind: z.enum(AgentCallTraceKind).default(AgentCallTraceKind.GENERATION),
+    /**
+     * The provider the call went to (`anthropic`, `openai`, ...). Optional because the trace allows its
+     * absence, and a call must still be recorded when the trace could not name its provider: the gap is
+     * then COUNTED by the evidence door rather than hidden by a dropped row.
+     */
+    provider: z.string().min(1).isDBIndexed().isSummaryField().optional(),
+    /** The resolved model id. Optional for the same reason as `provider`. */
+    model: z.string().min(1).isDBIndexed().isSummaryField().optional(),
+    /** 1-based attempt index when the caller drives a retry loop; each physical attempt is its own row. */
+    attempt: z.number().int().positive().optional(),
+    /** When the call was initiated, as the engine recorded it. The window the evidence door filters on. */
+    calledAt: z.date().isDBIndexed().isSummaryField(),
+    outcome: z.enum(AgentCallOutcome).isDBIndexed().isSummaryField(),
+    /** The provider's finish reason, when it gave one (`stop`, `length`, ...). */
+    finishReason: z.string().optional(),
+    /** Wall-clock duration of the call in milliseconds, as the engine measured it. */
+    durationMs: z.number().int().min(0).optional(),
+    /** Token usage, flat so the aggregation surface can sum each dimension on both adapters. */
+    promptTokens: z.number().int().min(0).optional(),
+    completionTokens: z.number().int().min(0).optional(),
+    totalTokens: z.number().int().min(0).optional(),
+    /**
+     * Whether the provider reported every usage dimension this kind of call has. Absent means the
+     * provider said nothing about completeness, which the evidence door reports as such rather than as
+     * complete.
+     */
+    usageComplete: z.boolean().optional(),
+    /** On a failed call: the error's class and code only. The message is NOT kept (see the file header). */
+    errorName: z.string().optional(),
+    errorCode: z.string().optional(),
+    /** Absolute expiry: `calledAt` plus {@link PROVIDER_CALL_RECORD_RETENTION_MS}. */
+    expiresAt: z.date().ttl({ expireAfterSeconds: 0 }),
+    createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+});
+/** Round a token or duration count into the integer the schema stores, or drop it when it is not a count. */
+function nonNegativeInteger(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? Math.round(value) : undefined;
+}
+/**
+ * The ONLY way a provider-call record is built: a closed projection of an {@link AgentCallTrace}.
+ *
+ * Closed on purpose. It names every field it copies, so the prompt, the completion and the error
+ * message cannot reach the table through a field someone adds to the trace later. `calledAt` falls
+ * back to `recordedAt` only when the trace's own timestamp does not parse, so a malformed timestamp
+ * costs precision rather than the record.
+ */
+export function projectProviderCallRecord(trace, { applicationId, recordedAt }) {
+    const parsed = Date.parse(trace.callTimestamp);
+    const calledAt = Number.isFinite(parsed) ? new Date(parsed) : recordedAt;
+    const usage = trace.context?.usage;
+    return {
+        applicationId,
+        agentRef: trace.agentRef,
+        kind: trace.kind ?? AgentCallTraceKind.GENERATION,
+        ...(trace.provider ? { provider: trace.provider } : {}),
+        ...(trace.model ? { model: trace.model } : {}),
+        ...(trace.attempt !== undefined ? { attempt: trace.attempt } : {}),
+        calledAt,
+        outcome: trace.outcome,
+        ...(trace.context?.finishReason ? { finishReason: String(trace.context.finishReason) } : {}),
+        ...(nonNegativeInteger(trace.context?.executionTime) !== undefined ? { durationMs: nonNegativeInteger(trace.context?.executionTime) } : {}),
+        ...(nonNegativeInteger(usage?.promptTokens) !== undefined ? { promptTokens: nonNegativeInteger(usage?.promptTokens) } : {}),
+        ...(nonNegativeInteger(usage?.completionTokens) !== undefined ? { completionTokens: nonNegativeInteger(usage?.completionTokens) } : {}),
+        ...(nonNegativeInteger(usage?.totalTokens) !== undefined ? { totalTokens: nonNegativeInteger(usage?.totalTokens) } : {}),
+        ...(typeof usage?.tokenUsageComplete === 'boolean' ? { usageComplete: usage.tokenUsageComplete } : {}),
+        ...(trace.error?.name ? { errorName: trace.error.name } : {}),
+        ...(trace.error?.code ? { errorCode: trace.error.code } : {}),
+        expiresAt: new Date(calledAt.getTime() + PROVIDER_CALL_RECORD_RETENTION_MS),
+    };
+}
+/**
+ * # Provider calls, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — what the application sent to which
+ * vendor is answerable for any window, without handing over a row.
+ *
+ * What `GET /assurance/provider-call-evidence` returns: COUNTS over a closed window, computed where the
+ * rows live. Counts rather than rows because the question ("was every call recorded with provider,
+ * model, usage and outcome?") is a statement about the population, and because a row names an agent
+ * and a timestamp that an evidence reader has no need to hold.
+ *
+ * The completeness counts are what make a gap visible: a call recorded with no provider, or a provider
+ * that reported no usage, is counted apart rather than folded into the total, so "every call was
+ * recorded" and "every recorded call is complete" are two separate answers.
+ */
+export const ProviderCallEvidenceSchema = z.object({
+    window: z.object({ from: z.string(), to: z.string() }),
+    /** Calls recorded in the window. */
+    totalCalls: z.number().int().min(0),
+    failedCalls: z.number().int().min(0),
+    /** Calls whose record names no provider, or no model: a trace that could not say where it went. */
+    callsWithoutProvider: z.number().int().min(0),
+    callsWithoutModel: z.number().int().min(0),
+    /** Calls for which the provider reported a token count at all. */
+    callsReportingTokens: z.number().int().min(0),
+    /** Calls whose usage the provider reported complete for that kind of call. */
+    callsWithCompleteUsage: z.number().int().min(0),
+    /**
+     * Every provider some engine capability declares on this backend, the answer to "does any capability
+     * select the provider a call went to?". A call to a provider outside it is an undeclared egress, which
+     * is `outbound-call-record` C2's MAJOR. Read from the running backend's own provider registry rather
+     * than from committed configuration, because the registry is what a call actually resolved against.
+     *
+     * `null` when the registry could not answer (not yet initialized). Never an empty list in that case:
+     * an empty list would read as "no provider is declared", and every call would look undeclared.
+     */
+    declaredProviderRefs: z.array(z.string()).nullable(),
+    /** One entry per provider, model, kind and outcome seen in the window. */
+    byProviderModel: z.array(z.object({
+        provider: z.string().nullable(),
+        model: z.string().nullable(),
+        kind: z.enum(AgentCallTraceKind),
+        outcome: z.enum(AgentCallOutcome),
+        calls: z.number().int().min(0),
+        promptTokens: z.number().min(0),
+        completionTokens: z.number().min(0),
+        totalTokens: z.number().min(0),
+    })),
+});
+//# sourceMappingURL=provider-call-records.shared.schemas.js.map

package/dist/esm/flows-actors/provider-call-records.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-call-records.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/provider-call-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAuB,MAAM,qCAAqC,CAAC;AAEhH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,2GAA2G;IAC3G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAE/C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAEvC,yGAAyG;IACzG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1D,8GAA8G;IAC9G,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC;IACvE;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACrE,yEAAyE;IACzE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAClE,uGAAuG;IACvG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE/C,uGAAuG;IACvG,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACjD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAChE,8EAA8E;IAC9E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,kFAAkF;IAClF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE9C,4FAA4F;IAC5F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAErC,wGAAwG;IACxG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,kFAAkF;IAClF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,6GAA6G;AAC7G,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqB,EACrB,EAAE,aAAa,EAAE,UAAU,EAA+C;IAE1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC;IACnC,OAAO;QACL,aAAa;QACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,kBAAkB,CAAC,UAAU;QACjD,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3I,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvI,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,GAAG,CAAC,OAAO,KAAK,EAAE,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,iCAAiC,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,oCAAoC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,mGAAmG;IACnG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC,CAAC;CACJ,CAAC,CAAC","sourcesContent":["/**\n * One row per PHYSICAL call to a model provider: which provider, which model, what kind of call, how\n * it ended and what it consumed. The queryable record that `evidence-requirement:outbound-call-record`\n * C2 demands (\"every physical provider call is recorded — provider, model, usage and outcome\").\n *\n * ## Why a store, when every call already emits a trace\n *\n * The engine emits an {@link AgentCallTrace} per call, and until this existed every destination of it\n * was TELEMETRY: the application log, an LLM-analytics vendor, an observability forwarder, the dev\n * companion's files. None is a store the product owns, so none can be queried for a window, and each\n * one's lifetime was set by log rotation or a vendor rather than by an evidence-retention decision.\n * The trace is also emitted only when an observability provider is active: at the default traceability\n * level `NONE` nothing is emitted at all. Evidence cannot depend on an observability setting, so this\n * record is written by its own seam, on every call, whatever the traceability level.\n *\n * ## Metadata only, by construction\n *\n * The trace carries the prompt (`input`), the completion (`output`) and the error MESSAGE, and any of\n * them can hold a person's content: a prompt is user text, and a provider error routinely echoes the\n * request back. None of them is copied. {@link projectProviderCallRecord} is the only producer, and it\n * reads a closed list of fields, so a field added to the trace later cannot reach this table by\n * accident. What stays is what the clause asks for plus what makes a row interpretable (duration,\n * finish reason, error class).\n *\n * Holding no content is also what makes this row NOT personal data: it describes a call the\n * application made, with no subject in it. That is why no field carries `dataCategories`, and why it\n * is not attributed to a user or a tenant. Per-tenant attribution would be useful for cost and is\n * deliberately left out until something reads it: an organization id here would make every row a\n * statement about a customer, with the retention and erasure obligations that follow.\n *\n * ## Retention\n *\n * Every row carries its own absolute expiry, {@link PROVIDER_CALL_RECORD_RETENTION_MS} after the call,\n * enforced by the framework's `.ttl()` mechanism: a TTL index on MongoDB and the bounded\n * `resource-retention-sweep` batch on PostgreSQL. Absolute rather than a window measured from a field,\n * so a later per-application retention choice changes what is WRITTEN and never needs a schema change,\n * the shape the scheduled-evidence records already use.\n */\nimport { z } from 'zod';\n\nimport { AgentCallOutcome, AgentCallTraceKind, type AgentCallTrace } from './agent-traceability.shared.schemas';\n\n/**\n * How long a provider-call record is kept: 400 days.\n *\n * The period this repository already keeps retained evidence for (scheduled-run evidence), chosen so\n * that one year of calls is always citable with a margin for the review that reads it. It belongs to\n * the `AUDIT_LOGS` retention class in spirit: the record an operator needs to show what the application\n * sent to whom, kept longer than operational logs for that reason.\n */\nexport const PROVIDER_CALL_RECORD_RETENTION_MS = 400 * 24 * 60 * 60 * 1000;\n\nexport const ProviderCallRecordSchema = z.object({\n  /** Document id. `.isPrimaryKey()` is what makes the PostgreSQL planner emit the PRIMARY KEY constraint. */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n\n  /**\n   * The application RECORD id, the APPLICATION scope's key. Stamped from the canonical identity by the\n   * recorder, never taken from the call, for the reason `JobExecution.applicationId` gives.\n   */\n  applicationId: z.string().isDBIndexed(),\n\n  /** The agent the call served (`agentRef`), or the service's own label for an embedding or extraction. */\n  agentRef: z.string().min(1).isDBIndexed().isSummaryField(),\n  /** GENERATION or EMBEDDING. The two consume tokens differently, so usage is only comparable within a kind. */\n  kind: z.enum(AgentCallTraceKind).default(AgentCallTraceKind.GENERATION),\n  /**\n   * The provider the call went to (`anthropic`, `openai`, ...). Optional because the trace allows its\n   * absence, and a call must still be recorded when the trace could not name its provider: the gap is\n   * then COUNTED by the evidence door rather than hidden by a dropped row.\n   */\n  provider: z.string().min(1).isDBIndexed().isSummaryField().optional(),\n  /** The resolved model id. Optional for the same reason as `provider`. */\n  model: z.string().min(1).isDBIndexed().isSummaryField().optional(),\n  /** 1-based attempt index when the caller drives a retry loop; each physical attempt is its own row. */\n  attempt: z.number().int().positive().optional(),\n\n  /** When the call was initiated, as the engine recorded it. The window the evidence door filters on. */\n  calledAt: z.date().isDBIndexed().isSummaryField(),\n  outcome: z.enum(AgentCallOutcome).isDBIndexed().isSummaryField(),\n  /** The provider's finish reason, when it gave one (`stop`, `length`, ...). */\n  finishReason: z.string().optional(),\n  /** Wall-clock duration of the call in milliseconds, as the engine measured it. */\n  durationMs: z.number().int().min(0).optional(),\n\n  /** Token usage, flat so the aggregation surface can sum each dimension on both adapters. */\n  promptTokens: z.number().int().min(0).optional(),\n  completionTokens: z.number().int().min(0).optional(),\n  totalTokens: z.number().int().min(0).optional(),\n  /**\n   * Whether the provider reported every usage dimension this kind of call has. Absent means the\n   * provider said nothing about completeness, which the evidence door reports as such rather than as\n   * complete.\n   */\n  usageComplete: z.boolean().optional(),\n\n  /** On a failed call: the error's class and code only. The message is NOT kept (see the file header). */\n  errorName: z.string().optional(),\n  errorCode: z.string().optional(),\n\n  /** Absolute expiry: `calledAt` plus {@link PROVIDER_CALL_RECORD_RETENTION_MS}. */\n  expiresAt: z.date().ttl({ expireAfterSeconds: 0 }),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type ProviderCallRecord = z.infer<typeof ProviderCallRecordSchema>;\n\n/** Round a token or duration count into the integer the schema stores, or drop it when it is not a count. */\nfunction nonNegativeInteger(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? Math.round(value) : undefined;\n}\n\n/**\n * The ONLY way a provider-call record is built: a closed projection of an {@link AgentCallTrace}.\n *\n * Closed on purpose. It names every field it copies, so the prompt, the completion and the error\n * message cannot reach the table through a field someone adds to the trace later. `calledAt` falls\n * back to `recordedAt` only when the trace's own timestamp does not parse, so a malformed timestamp\n * costs precision rather than the record.\n */\nexport function projectProviderCallRecord(\n  trace: AgentCallTrace,\n  { applicationId, recordedAt }: { applicationId: string; recordedAt: Date },\n): Omit<ProviderCallRecord, '_id' | 'createdAt'> {\n  const parsed = Date.parse(trace.callTimestamp);\n  const calledAt = Number.isFinite(parsed) ? new Date(parsed) : recordedAt;\n  const usage = trace.context?.usage;\n  return {\n    applicationId,\n    agentRef: trace.agentRef,\n    kind: trace.kind ?? AgentCallTraceKind.GENERATION,\n    ...(trace.provider ? { provider: trace.provider } : {}),\n    ...(trace.model ? { model: trace.model } : {}),\n    ...(trace.attempt !== undefined ? { attempt: trace.attempt } : {}),\n    calledAt,\n    outcome: trace.outcome,\n    ...(trace.context?.finishReason ? { finishReason: String(trace.context.finishReason) } : {}),\n    ...(nonNegativeInteger(trace.context?.executionTime) !== undefined ? { durationMs: nonNegativeInteger(trace.context?.executionTime) } : {}),\n    ...(nonNegativeInteger(usage?.promptTokens) !== undefined ? { promptTokens: nonNegativeInteger(usage?.promptTokens) } : {}),\n    ...(nonNegativeInteger(usage?.completionTokens) !== undefined ? { completionTokens: nonNegativeInteger(usage?.completionTokens) } : {}),\n    ...(nonNegativeInteger(usage?.totalTokens) !== undefined ? { totalTokens: nonNegativeInteger(usage?.totalTokens) } : {}),\n    ...(typeof usage?.tokenUsageComplete === 'boolean' ? { usageComplete: usage.tokenUsageComplete } : {}),\n    ...(trace.error?.name ? { errorName: trace.error.name } : {}),\n    ...(trace.error?.code ? { errorCode: trace.error.code } : {}),\n    expiresAt: new Date(calledAt.getTime() + PROVIDER_CALL_RECORD_RETENTION_MS),\n  };\n}\n\n/**\n * # Provider calls, summarized for an evidence reader\n *\n * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — what the application sent to which\n * vendor is answerable for any window, without handing over a row.\n *\n * What `GET /assurance/provider-call-evidence` returns: COUNTS over a closed window, computed where the\n * rows live. Counts rather than rows because the question (\"was every call recorded with provider,\n * model, usage and outcome?\") is a statement about the population, and because a row names an agent\n * and a timestamp that an evidence reader has no need to hold.\n *\n * The completeness counts are what make a gap visible: a call recorded with no provider, or a provider\n * that reported no usage, is counted apart rather than folded into the total, so \"every call was\n * recorded\" and \"every recorded call is complete\" are two separate answers.\n */\nexport const ProviderCallEvidenceSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  /** Calls recorded in the window. */\n  totalCalls: z.number().int().min(0),\n  failedCalls: z.number().int().min(0),\n  /** Calls whose record names no provider, or no model: a trace that could not say where it went. */\n  callsWithoutProvider: z.number().int().min(0),\n  callsWithoutModel: z.number().int().min(0),\n  /** Calls for which the provider reported a token count at all. */\n  callsReportingTokens: z.number().int().min(0),\n  /** Calls whose usage the provider reported complete for that kind of call. */\n  callsWithCompleteUsage: z.number().int().min(0),\n  /**\n   * Every provider some engine capability declares on this backend, the answer to \"does any capability\n   * select the provider a call went to?\". A call to a provider outside it is an undeclared egress, which\n   * is `outbound-call-record` C2's MAJOR. Read from the running backend's own provider registry rather\n   * than from committed configuration, because the registry is what a call actually resolved against.\n   *\n   * `null` when the registry could not answer (not yet initialized). Never an empty list in that case:\n   * an empty list would read as \"no provider is declared\", and every call would look undeclared.\n   */\n  declaredProviderRefs: z.array(z.string()).nullable(),\n  /** One entry per provider, model, kind and outcome seen in the window. */\n  byProviderModel: z.array(z.object({\n    provider: z.string().nullable(),\n    model: z.string().nullable(),\n    kind: z.enum(AgentCallTraceKind),\n    outcome: z.enum(AgentCallOutcome),\n    calls: z.number().int().min(0),\n    promptTokens: z.number().min(0),\n    completionTokens: z.number().min(0),\n    totalTokens: z.number().min(0),\n  })),\n});\nexport type ProviderCallEvidence = z.infer<typeof ProviderCallEvidenceSchema>;\n"]}